spf-discuss
[Top] [All Lists]

Re: [spf-discuss] How reliable is it to block/reject on SPF fail?

2009-11-28 11:16:57
At 15:14 28/11/2009  Saturday, Alessandro Vesely wrote:
alan wrote:
At 07:48 27/11/2009  Friday, Alessandro Vesely wrote:
I cannot understand this. Webmail servers only have the chance to determine 
that a message appears to be forwarded, and hence present the big button, 
_after_ they have already accepted the message. What do they do if the user 
does _not_ whitelist the sender at that stage?
yes this only happens on the 90% of non SPF using mail that gets through {but 
appears non-srs-forwarded}
the link is presented beside the rejected mail {due to SPF failure} in their 
web based view of the rejected mail log
{we provide a rejected mail log to the user so they can tweak which 
DNSBL's,HELO-checks,PTR-checks,manual whitelists/blacklists etc are 
working/not-working for them, and ammend their filtering config appropriatly}
we have found it works well with over time the user turning on more and more 
aggressive checks and whitelisting senders when needed, {often pruning their 
whitelists after convincing sender to stop doing whatever dumb thing caused 
the test to fail, like helo-as blah.blah.local}

Ah, now I got it. It seems clever enough to me, even if users have to miss the 
very first messages --probably tests in most cases.

I agree with Ian that it would be nice to have something like this as a 
standard. That might provide for the sender setting up any relevant detail, 
and (non-geek) users just having to agree, either manually or automatically. 
However, the obvious advantage of your approach is that it requires minimal or 
no compliance from senders.

well the preferences are currently inherited from owner thus

root can change global defaults for all domains {and add postmasters and 
domains} {also can access per postmaster defaults, per domain defaults and per 
user defaults and per address settings}
    a-postmaster can change defaults for all domains he controls {and add users 
and address} {also can set per-domain defaults, and per user defaults and per 
address settings}
         a-user can change defaults for all address allocated to them by the 
postmaster and settings for each address only

root and postmaster have the options hard-on, hard-off, on and off
postmaster and user have the extra option of inherit
users only have on off or inherit

hard-on forces lower {postmasters/users} to only have inherit selectable {with 
an idicator showing value is on}
hard-off forces lower {postmasters/users} to only have inherit selectable {with 
an idicator showing value is off}
on means option is on for all below with inherit selected
off means option is off for all below with inherit selected

we give a postmaster id-password to the it/mail guy at receiving site we do 
inbound mail for and some just never create user accounts they just keep all 
address' under postmaster control and handle the calls/changes tweaks for their 
users

but some do force all users to handle their own, and some do the most common of 
only creating user accounts for those competent enough to run them themselves

One added benefit is that users have a means to maintain a list of their 
whitelistings, subscriptions, etcetera.

that was my main aim in my building of this
{ok first motive was so i could run draconian anti-spammer and 
anti-idioticly-setup-mta filtering on my own address' without affecting other 
users and leaving abuse and postmaster open for all spam*}
{but later i realised that others might appreciate having the utility to alter 
their own filtering per-address also}
{i'm hoping it will lead to users pressuring idiotic-mta owners to clean-up, 
due to them seeing that 90% of spam would be blocked by the same test-fail that 
idiot-legit-sender keeps hitting so by convincing legit-sender to fix his mta 
they can then turn on reject-on-fail for that test}
{also we add headers for each test-fail on accepted mail so user can see the 
idiot-legit-senders has issues, hoping that embarrassment will also motivate 
senders to send mail so it dosn't gain an X-DUMB-xxx header}

*anyone ever trying to report spam/piracy to hotmail or piracy(_at_)M$ knows 
why spamfiltering postmaster and abuse is counterproductive {you don't get the 
complaints so you never kill the customer so your rep rapidly hits floor}
 




-------------------------------------------
Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
Modify Your Subscription: http://www.listbox.com/member/ 
[http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/735/=now
RSS Feed: https://www.listbox.com/member/archive/rss/735/
Powered by Listbox: http://www.listbox.com



-------------------------------------------
Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
Modify Your Subscription: http://www.listbox.com/member/ 
[http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/735/=now
RSS Feed: https://www.listbox.com/member/archive/rss/735/
Powered by Listbox: http://www.listbox.com

<Prev in Thread] Current Thread [Next in Thread>